PHP security update: critical release requires immediate action

The PHP project has published a security release that addresses two critical vulnerabilities, according to WordPress.org. Site owners are being asked to update their PHP installations immediately because of the severity of the issues.

Why this PHP security update matters to your site

The vulnerabilities are not limited to one platform, they affect any server that hosts a PHP application, WordPress.org warns. That means both WordPress sites and other PHP-based applications may be exposed until the server's PHP installation is updated or other mitigations are applied. WordPress itself does not need a code update for this issue, and none is planned, because the problem lies in PHP rather than WordPress software.

WordPress.org also notes that versions of PHP prior to 8.2 no longer receive security updates from the PHP project. If your site runs an unsupported PHP version, it will not get security fixes from PHP upstream, which increases risk when new vulnerabilities are discovered.

How to check what PHP your site runs

If your site uses WordPress, you can find the PHP version in your dashboard under Tools > Site Health > Info > Server, as WordPress.org explains. Many web hosts also show the PHP version in the hosting control panel or administration interface. If you are unsure where to look, contact your hosting provider and ask them what PHP version is active for your account.

PHP security update: immediate steps

Follow these steps now, in the order that fits your setup:

• Check your current PHP version and record it. If you use WordPress, follow Tools > Site Health > Info > Server. If you use another control panel, check the server or account settings.
• Contact your web host to confirm whether they are applying the PHP security release and whether they have put WAF rules or other mitigations in place.
• If your host is not yet updating your account, or you manage your own server, schedule and apply the PHP update as soon as possible to a supported version.
• If you cannot update immediately, work with your host to put temporary mitigations in place, such as web application firewall rules.
• After updating, verify your site functionality and monitor logs for unusual activity. Keep backups in place before making changes.

These actions follow the guidance WordPress.org gives to reduce exposure while the PHP project distributes fixes.

If you manage your own hosting

WordPress.org summarizes advice from national cyber security agencies for administrators who control their own servers. If you run a PHP version that no longer receives security updates, the post recommends planning an update to a newer, supported PHP version. Where an immediate fix is not possible, WordPress.org quotes the UK National Cyber Security Centre: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated." Use that guidance to weigh the risks of keeping a live site online versus the operational impact of taking a service offline while you apply patches.

What to do next

Start by checking your PHP version and contacting your host if you do not manage the server yourself. If you manage your own hosting, prepare an update plan and consider temporary containment steps if you cannot apply the patch immediately. WordPress.org provides a short roundup and links to further information on updating PHP, compatibility, and recovery steps for compromised sites at the source post: WordPress.org announcement.

If you want hands-on help from a developer familiar with WordPress hosting and PHP updates, get in touch and we can review options for updating or isolating your site safely: /contact.html

Keep this guidance visible to whoever manages your hosting and deployments so the update happens quickly and with minimal downtime.